Overview

overview

10

Static

static

3

RedLine stealer_2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RedLine stealer_2.exe

  • Size

    226KB

  • Sample

    241219-an4faayrhj

  • MD5

    97faf1e3eb855bf6e8a96615b2b094c8

  • SHA1

    19941236fbb40357a8d8ffc9b26f6208415e7bdd

  • SHA256

    b05a673d7e1071375cc3c5d595753379c8f5782d147e18732def1775ef33e82f

  • SHA512

    a71cc8a7527444697f4d4117b880efc8d492f42f7e70f3efa0a741403577effa15013c247ca62b68e7672388f0fa8c6504a3053e4dd09535d497e3e179d1928c

  • SSDEEP

    6144:zUU4EEN/9GWKfmEK+fBGt4t9Sqye5cxUXpt0GvVA:AEENoWKXGt4tke5cCT

Score
10/10
asyncratdefaultdiscoverypersistencerat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

odvuhfivfndnrco

Attributes
  • delay

    1

  • install

    false

  • install_file

    Nivida Control Panel.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/P0ea2dX4

aes.plain

Targets

    • Target

      RedLine stealer_2.exe

    • Size

      226KB

    • MD5

      97faf1e3eb855bf6e8a96615b2b094c8

    • SHA1

      19941236fbb40357a8d8ffc9b26f6208415e7bdd

    • SHA256

      b05a673d7e1071375cc3c5d595753379c8f5782d147e18732def1775ef33e82f

    • SHA512

      a71cc8a7527444697f4d4117b880efc8d492f42f7e70f3efa0a741403577effa15013c247ca62b68e7672388f0fa8c6504a3053e4dd09535d497e3e179d1928c

    • SSDEEP

      6144:zUU4EEN/9GWKfmEK+fBGt4t9Sqye5cxUXpt0GvVA:AEENoWKXGt4tke5cCT

    Score
    10/10
    asyncratdefaultdiscoverypersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks